@vellumai/assistant 0.6.5 → 0.6.6

package/src/permissions/command-registry.ts

@@ -31,9 +31,11 @@ const TMP_PATHS = String.raw`^(?:/tmp|/var/tmp|\./|\.\.\/)`;
 
 export const DEFAULT_COMMAND_REGISTRY = {
   // ── Read-only filesystem commands ──────────────────────────────────────────
-  ls: { baseRisk: "low" },
+  ls: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
   cat: {
     baseRisk: "low",
+    sandboxAutoApprove: true,
+    argSchema: {},
     argRules: [
       {
         id: "cat:sensitive",
@@ -43,33 +45,78 @@ export const DEFAULT_COMMAND_REGISTRY = {
       },
     ],
   },
-  head: { baseRisk: "low" },
-  tail: { baseRisk: "low" },
-  less: { baseRisk: "low" },
-  more: { baseRisk: "low" },
-  wc: { baseRisk: "low" },
-  file: { baseRisk: "low" },
-  stat: { baseRisk: "low" },
-  du: { baseRisk: "low" },
-  df: { baseRisk: "low" },
-  diff: { baseRisk: "low" },
-  tree: { baseRisk: "low" },
-  pwd: { baseRisk: "low" },
-  realpath: { baseRisk: "low" },
-  basename: { baseRisk: "low" },
-  dirname: { baseRisk: "low" },
+  head: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
+  tail: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
+  less: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
+  more: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
+  wc: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
+  file: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
+  stat: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
+  du: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
+  df: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
+  diff: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
+  tree: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
+  pwd: {
+    baseRisk: "low",
+    sandboxAutoApprove: true,
+    argSchema: { positionals: "none" },
+  },
+  realpath: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
+  basename: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
+  dirname: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
+  readlink: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
 
   // ── Search / filter / text processing ──────────────────────────────────────
-  grep: { baseRisk: "low" },
-  rg: { baseRisk: "low" },
-  ag: { baseRisk: "low" },
-  ack: { baseRisk: "low" },
-  sort: { baseRisk: "low" },
-  uniq: { baseRisk: "low" },
-  cut: { baseRisk: "low" },
-  tr: { baseRisk: "low" },
-  sed: {
+  grep: {
     baseRisk: "low",
+    sandboxAutoApprove: true,
+    argSchema: {
+      positionals: [{ role: "pattern" }, { role: "path", rest: true }],
+    },
+  },
+  rg: {
+    baseRisk: "low",
+    sandboxAutoApprove: true,
+    argSchema: {
+      positionals: [{ role: "pattern" }, { role: "path", rest: true }],
+    },
+  },
+  ag: {
+    baseRisk: "low",
+    sandboxAutoApprove: true,
+    argSchema: {
+      positionals: [{ role: "pattern" }, { role: "path", rest: true }],
+    },
+  },
+  ack: {
+    baseRisk: "low",
+    sandboxAutoApprove: true,
+    argSchema: {
+      positionals: [{ role: "pattern" }, { role: "path", rest: true }],
+    },
+  },
+  sort: {
+    baseRisk: "low",
+    sandboxAutoApprove: true,
+    argSchema: {
+      valueFlags: ["-o", "--output"],
+      pathFlags: { "-o": true, "--output": true },
+    },
+  },
+  uniq: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
+  cut: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
+  tr: {
+    baseRisk: "low",
+    sandboxAutoApprove: true,
+    argSchema: { positionals: "none" },
+  },
+  sed: {
+    baseRisk: "medium",
+    reason: "Can write files or execute commands via sed scripts",
+    sandboxAutoApprove: true,
+    argSchema: {
+      positionals: [{ role: "script" }, { role: "path", rest: true }],
+    },
     argRules: [
       {
         id: "sed:inplace",
@@ -81,13 +128,24 @@ export const DEFAULT_COMMAND_REGISTRY = {
   },
   awk: {
     baseRisk: "medium",
+    argSchema: {
+      positionals: [{ role: "script" }, { role: "path", rest: true }],
+    },
     complexSyntax: true,
     reason: "Can execute shell commands via system()",
   },
 
   // ── System information (read-only) ─────────────────────────────────────────
-  echo: { baseRisk: "low" },
-  printf: { baseRisk: "low" },
+  echo: {
+    baseRisk: "low",
+    sandboxAutoApprove: true,
+    argSchema: { positionals: "none" },
+  },
+  printf: {
+    baseRisk: "low",
+    sandboxAutoApprove: true,
+    argSchema: { positionals: "none" },
+  },
   whoami: { baseRisk: "low" },
   uname: { baseRisk: "low" },
   uptime: { baseRisk: "low" },
@@ -113,14 +171,31 @@ export const DEFAULT_COMMAND_REGISTRY = {
   hexdump: { baseRisk: "low" },
 
   // ── Data processing ────────────────────────────────────────────────────────
-  jq: { baseRisk: "low" },
-  yq: { baseRisk: "low" },
+  jq: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
+  yq: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
 
   // ── Find ───────────────────────────────────────────────────────────────────
   // DIVERGENCE: checker.ts lists `find` as LOW_RISK unconditionally. Our
   // registry adds arg rules for -exec/-execdir/-delete which escalate to high.
   find: {
     baseRisk: "low",
+    argSchema: {
+      valueFlags: [
+        "-name",
+        "-iname",
+        "-path",
+        "-ipath",
+        "-regex",
+        "-iregex",
+        "-maxdepth",
+        "-mindepth",
+        "-newer",
+        "-user",
+        "-group",
+        "-printf",
+        "-fprintf",
+      ],
+    },
     complexSyntax: true,
     argRules: [
       {
@@ -137,11 +212,16 @@ export const DEFAULT_COMMAND_REGISTRY = {
       },
     ],
   },
-  fd: { baseRisk: "low" },
+  fd: { baseRisk: "low", sandboxAutoApprove: true, argSchema: {} },
 
   // ── Write commands ─────────────────────────────────────────────────────────
   cp: {
     baseRisk: "medium",
+    sandboxAutoApprove: true,
+    argSchema: {
+      valueFlags: ["-t", "--target-directory"],
+      pathFlags: { "-t": true, "--target-directory": true },
+    },
     argRules: [
       {
         id: "cp:system",
@@ -153,6 +233,8 @@ export const DEFAULT_COMMAND_REGISTRY = {
   },
   mv: {
     baseRisk: "medium",
+    sandboxAutoApprove: true,
+    argSchema: {},
     argRules: [
       {
         id: "mv:system",
@@ -162,15 +244,25 @@ export const DEFAULT_COMMAND_REGISTRY = {
       },
     ],
   },
-  mkdir: { baseRisk: "medium" },
-  touch: { baseRisk: "medium" },
+  mkdir: { baseRisk: "medium", sandboxAutoApprove: true, argSchema: {} },
+  touch: { baseRisk: "medium", sandboxAutoApprove: true, argSchema: {} },
+  ln: {
+    baseRisk: "medium",
+    sandboxAutoApprove: true,
+    argSchema: {
+      valueFlags: ["-t", "--target-directory"],
+      pathFlags: { "-t": true, "--target-directory": true },
+    },
+  },
   // DIVERGENCE: checker.ts lists `tee` as LOW_RISK. Our registry classifies
   // it as medium because it writes to files.
-  tee: { baseRisk: "medium" },
+  tee: { baseRisk: "medium", sandboxAutoApprove: true, argSchema: {} },
 
   // ── Delete commands ────────────────────────────────────────────────────────
   rm: {
     baseRisk: "high",
+    sandboxAutoApprove: true,
+    argSchema: {},
     argRules: [
       {
         id: "rm:recursive-force",
@@ -204,11 +296,45 @@ export const DEFAULT_COMMAND_REGISTRY = {
       },
     ],
   },
-  rmdir: { baseRisk: "high" },
+  rmdir: { baseRisk: "high", sandboxAutoApprove: true, argSchema: {} },
 
   // ── Network commands ───────────────────────────────────────────────────────
   curl: {
     baseRisk: "medium",
+    argSchema: {
+      valueFlags: [
+        "-d",
+        "--data",
+        "--data-binary",
+        "--data-raw",
+        "--data-urlencode",
+        "-T",
+        "--upload-file",
+        "-o",
+        "--output",
+        "-H",
+        "--header",
+        "-X",
+        "--request",
+        "-u",
+        "--user",
+        "-A",
+        "--user-agent",
+        "-e",
+        "--referer",
+        "-b",
+        "--cookie",
+        "-c",
+        "--cookie-jar",
+        "--connect-timeout",
+        "-m",
+        "--max-time",
+        "--retry",
+        "-w",
+        "--write-out",
+      ],
+      positionals: "none", // positionals are URLs, not paths
+    },
     argRules: [
       {
         id: "curl:upload-data",
@@ -254,15 +380,17 @@ export const DEFAULT_COMMAND_REGISTRY = {
   // Divergences are noted inline.
   git: {
     baseRisk: "medium",
-    globalValueFlags: [
-      "-C",
-      "-c",
-      "--git-dir",
-      "--work-tree",
-      "--namespace",
-      "--super-prefix",
-      "--config-env",
-    ],
+    argSchema: {
+      valueFlags: [
+        "-C",
+        "-c",
+        "--git-dir",
+        "--work-tree",
+        "--namespace",
+        "--super-prefix",
+        "--config-env",
+      ],
+    },
     subcommands: {
       // LOW_RISK_GIT_SUBCOMMANDS from checker.ts:
       status: { baseRisk: "low" },
@@ -357,7 +485,9 @@ export const DEFAULT_COMMAND_REGISTRY = {
   // they download and execute code, with subcommand-level overrides.
   npm: {
     baseRisk: "medium",
-    globalValueFlags: ["--prefix", "--userconfig", "--globalconfig", "--cache"],
+    argSchema: {
+      valueFlags: ["--prefix", "--userconfig", "--globalconfig", "--cache"],
+    },
     subcommands: {
       ls: { baseRisk: "low" },
       list: { baseRisk: "low" },
@@ -531,7 +661,9 @@ export const DEFAULT_COMMAND_REGISTRY = {
   // ── Docker ─────────────────────────────────────────────────────────────────
   docker: {
     baseRisk: "medium",
-    globalValueFlags: ["--host", "-H", "--config", "--context", "--log-level"],
+    argSchema: {
+      valueFlags: ["--host", "-H", "--config", "--context", "--log-level"],
+    },
     subcommands: {
       ps: { baseRisk: "low" },
       images: { baseRisk: "low" },
@@ -544,6 +676,26 @@ export const DEFAULT_COMMAND_REGISTRY = {
       push: { baseRisk: "high", reason: "Pushes image to registry" },
       run: {
         baseRisk: "high",
+        argSchema: {
+          valueFlags: [
+            "-v",
+            "--volume",
+            "-p",
+            "--publish",
+            "-e",
+            "--env",
+            "--name",
+            "--network",
+            "-w",
+            "--workdir",
+            "--entrypoint",
+            "--mount",
+            "--cpus",
+            "--memory",
+            "--user",
+            "--platform",
+          ],
+        },
         reason: "Runs arbitrary container",
         argRules: [
           {
@@ -584,9 +736,24 @@ export const DEFAULT_COMMAND_REGISTRY = {
     isWrapper: true,
     reason: "Elevates privileges (OpenBSD sudo alternative)",
   },
-  chmod: { baseRisk: "high", reason: "Changes file permissions" },
-  chown: { baseRisk: "high", reason: "Changes file ownership" },
-  chgrp: { baseRisk: "high", reason: "Changes file group" },
+  chmod: {
+    baseRisk: "high",
+    sandboxAutoApprove: true,
+    argSchema: {},
+    reason: "Changes file permissions",
+  },
+  chown: {
+    baseRisk: "high",
+    sandboxAutoApprove: true,
+    argSchema: {},
+    reason: "Changes file ownership",
+  },
+  chgrp: {
+    baseRisk: "high",
+    sandboxAutoApprove: true,
+    argSchema: {},
+    reason: "Changes file group",
+  },
   mount: { baseRisk: "high", reason: "Mounts filesystem" },
   umount: { baseRisk: "high", reason: "Unmounts filesystem" },
   systemctl: { baseRisk: "high", reason: "Controls system services" },
@@ -726,16 +893,29 @@ export const DEFAULT_COMMAND_REGISTRY = {
     complexSyntax: true,
     reason: "Executes command with piped arguments",
   },
-  tar: { baseRisk: "medium", complexSyntax: true },
-  zip: { baseRisk: "medium" },
-  unzip: { baseRisk: "medium" },
-  gzip: { baseRisk: "medium" },
-  gunzip: { baseRisk: "medium" },
+  tar: {
+    baseRisk: "medium",
+    sandboxAutoApprove: true,
+    argSchema: {
+      valueFlags: ["-C", "--directory", "-f", "--file"],
+      pathFlags: {
+        "-C": true,
+        "--directory": true,
+        "-f": true,
+        "--file": true,
+      },
+    },
+    complexSyntax: true,
+  },
+  zip: { baseRisk: "medium", sandboxAutoApprove: true, argSchema: {} },
+  unzip: { baseRisk: "medium", sandboxAutoApprove: true, argSchema: {} },
+  gzip: { baseRisk: "medium", sandboxAutoApprove: true, argSchema: {} },
+  gunzip: { baseRisk: "medium", sandboxAutoApprove: true, argSchema: {} },
 
   // ── Version control tools ──────────────────────────────────────────────────
   gh: {
     baseRisk: "low",
-    globalValueFlags: ["--repo", "-R"],
+    argSchema: { valueFlags: ["--repo", "-R"] },
     subcommands: {
       pr: {
         baseRisk: "low",

package/src/permissions/defaults.ts

@@ -85,10 +85,11 @@ export function getDefaultRuleTemplates(): DefaultRuleTemplate[] {
   };
 
   // When running inside a container (IS_CONTAINERIZED=true), bash commands
-  // execute in an isolated environment — auto-allow all of them so the user
-  // is never prompted. High-risk operations are handled by
-  // shouldAutoAllowHighRisk() in checker.ts. Outside a container, bash
-  // commands run on the host and go through normal permission checks.
+  // with sandboxAutoApprove tags auto-allow via the approval policy's
+  // sandbox auto-approve check. Non-allowlisted commands matched by the
+  // default allow rule below are still auto-allowed at low/medium risk;
+  // only high-risk non-allowlisted commands (runtimes, privilege escalation)
+  // fall through to be prompted.
   const bashShellRule: DefaultRuleTemplate | null = getIsContainerized()
     ? {
         id: "default:allow-bash-global",

package/src/permissions/gateway-threshold-reader.ts

@@ -0,0 +1,196 @@
+/**
+ * Gateway-backed auto-approve threshold reader.
+ *
+ * When the `permission-controls-v3` feature flag is enabled, reads
+ * thresholds from the gateway via IPC. Falls back to `undefined` (caller
+ * uses config-based `resolveThreshold`) when the flag is off or the gateway
+ * is unreachable.
+ */
+
+import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
+import { getConfig } from "../config/loader.js";
+import { ipcCall } from "../ipc/gateway-client.js";
+import { getLogger } from "../util/logger.js";
+import type { ExecutionContext } from "./approval-policy.js";
+
+const log = getLogger("gateway-threshold-reader");
+
+// ── Types ────────────────────────────────────────────────────────────────────
+
+type Threshold = "none" | "low" | "medium" | "high";
+
+interface GlobalThresholds {
+  interactive: string;
+  background: string;
+  headless: string;
+}
+
+interface ConversationThreshold {
+  threshold: string;
+}
+
+// ── Global threshold cache (30s TTL) ─────────────────────────────────────────
+
+let cachedGlobalThresholds: GlobalThresholds | null = null;
+let cachedGlobalTimestamp = 0;
+const GLOBAL_CACHE_TTL_MS = 30_000;
+
+// ── Conversation threshold cache (5s TTL) ────────────────────────────────────
+// Shorter TTL than global because the user can change mid-conversation via the
+// picker UI, but still avoids a network roundtrip on every single tool call
+// within a burst.
+
+const conversationThresholdCache = new Map<
+  string,
+  { threshold: string | null; timestamp: number }
+>();
+const CONVERSATION_CACHE_TTL_MS = 5_000;
+
+/**
+ * Clear the global threshold cache. Exported for testing.
+ */
+export function _clearGlobalCacheForTesting(): void {
+  cachedGlobalThresholds = null;
+  cachedGlobalTimestamp = 0;
+  conversationThresholdCache.clear();
+}
+
+// ── Hardcoded fallback defaults ──────────────────────────────────────────────
+
+const HARDCODED_DEFAULTS: Record<ExecutionContext, Threshold> = {
+  conversation: "low",
+  background: "medium",
+  headless: "none",
+};
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+function mapExecutionContextToField(
+  executionContext: ExecutionContext,
+): keyof GlobalThresholds {
+  if (executionContext === "conversation") return "interactive";
+  return executionContext;
+}
+
+function isValidThreshold(value: string): value is Threshold {
+  return (
+    value === "none" ||
+    value === "low" ||
+    value === "medium" ||
+    value === "high"
+  );
+}
+
+// ── Main export ──────────────────────────────────────────────────────────────
+
+/**
+ * Read the auto-approve threshold from the gateway via IPC.
+ *
+ * Returns `undefined` when the feature flag is off (caller falls back to
+ * config-based `resolveThreshold`).
+ *
+ * For `"conversation"` context with a `conversationId`, checks for a
+ * per-conversation override first. Falls through to global defaults when
+ * the conversation override is absent.
+ *
+ * Caches global thresholds for 30 seconds to avoid hammering the gateway.
+ * On any IPC error, logs a warning and returns hardcoded defaults.
+ */
+export async function getAutoApproveThreshold(
+  conversationId: string | undefined,
+  executionContext?: ExecutionContext,
+): Promise<Threshold | undefined> {
+  const config = getConfig();
+  if (!isAssistantFeatureFlagEnabled("permission-controls-v3", config)) {
+    return undefined;
+  }
+
+  const ctx: ExecutionContext = executionContext ?? "conversation";
+
+  // For conversation context with a conversationId, try per-conversation override first
+  if (ctx === "conversation" && conversationId) {
+    // Check cache first (5s TTL) — includes negative entries (no override)
+    const cached = conversationThresholdCache.get(conversationId);
+    if (cached && Date.now() - cached.timestamp < CONVERSATION_CACHE_TTL_MS) {
+      if (cached.threshold === null) {
+        // Negative cache hit — no override exists, fall through to global
+      } else if (isValidThreshold(cached.threshold)) {
+        return cached.threshold;
+      }
+    } else {
+      // ipcCall() returns undefined on transport failure (socket not found,
+      // timeout, etc.) and null when the gateway explicitly says "no override".
+      // We must distinguish the two: only cache the negative on `null`, and
+      // fall back to hardcoded defaults on `undefined` without poisoning the
+      // cache — otherwise a transient IPC failure would cause subsequent
+      // approval checks to skip a real override for up to 5 seconds.
+      const result = (await ipcCall("get_conversation_threshold", {
+        conversationId,
+      })) as ConversationThreshold | null | undefined;
+
+      if (result === undefined) {
+        log.warn(
+          { conversationId },
+          "IPC call failed for conversation threshold override, falling back to defaults",
+        );
+        return HARDCODED_DEFAULTS[ctx];
+      }
+
+      if (result && isValidThreshold(result.threshold)) {
+        conversationThresholdCache.set(conversationId, {
+          threshold: result.threshold,
+          timestamp: Date.now(),
+        });
+        return result.threshold;
+      }
+
+      // result === null (or an unexpected shape) — cache the negative result
+      // and fall through to global defaults.
+      conversationThresholdCache.set(conversationId, {
+        threshold: null,
+        timestamp: Date.now(),
+      });
+    }
+  }
+
+  // Fetch global thresholds (with 30s cache)
+  try {
+    const global = await fetchGlobalThresholds();
+    const field = mapExecutionContextToField(ctx);
+    const value = global[field];
+    if (isValidThreshold(value)) {
+      return value;
+    }
+    // Unexpected value from gateway — fall back to hardcoded
+    log.warn({ field, value }, "Gateway returned unexpected threshold value");
+    return HARDCODED_DEFAULTS[ctx];
+  } catch (err) {
+    log.warn(
+      { error: String(err) },
+      "Failed to fetch global thresholds, falling back to defaults",
+    );
+    return HARDCODED_DEFAULTS[ctx];
+  }
+}
+
+async function fetchGlobalThresholds(): Promise<GlobalThresholds> {
+  const now = Date.now();
+  if (
+    cachedGlobalThresholds &&
+    now - cachedGlobalTimestamp < GLOBAL_CACHE_TTL_MS
+  ) {
+    return cachedGlobalThresholds;
+  }
+
+  const result = (await ipcCall(
+    "get_global_thresholds",
+  )) as GlobalThresholds | null;
+
+  if (!result) {
+    throw new Error("Gateway IPC returned no result for global thresholds");
+  }
+
+  cachedGlobalThresholds = result;
+  cachedGlobalTimestamp = Date.now();
+  return result;
+}

package/src/permissions/prompter.ts

@@ -66,6 +66,8 @@ export class PermissionPrompter {
     temporaryOptionsAvailable?: Array<"allow_10m" | "allow_conversation">,
     toolUseId?: string,
     hostAccessEnablePrompt?: boolean,
+    riskReason?: string,
+    isContainerized?: boolean,
   ): Promise<{
     decision: UserDecision;
     selectedPattern?: string;
@@ -116,6 +118,8 @@ export class PermissionPrompter {
         toolName,
         input: redactSensitiveFields(input),
         riskLevel,
+        riskReason,
+        isContainerized,
         allowlistOptions: allowlistOptions.map((o) => ({
           label: o.label,
           description: o.description,